Authenticate a user and obtain an authorization code

Anonymous endpoint used by the web UI and device-flow clients to exchange user credentials (plus optional MFA token and PKCE challenge) for an OAuth authorization client_code that can then be exchanged for an access token via POST /auth/token. Rate-limited as an anonymous request.